PT-2017-10800 · Apache+1 · Groovy+1

Simon St John-Green · Published 2017-10-04 · Updated 2022-05-13 · CVE-2017-1000095

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description.

Description The issue concerns the default whitelist in a script sandbox, which includes unsafe entries such as DefaultGroovyMethods.putAt(Object, String, Object) and DefaultGroovyMethods.getAt(Object, String). These entries allow for circumventing access restrictions by using alternative methods to access properties, for example, currentBuild['rawBuild'] instead of currentBuild.rawBuild. Furthermore, certain entries like groovy.json.JsonOutput.toJson(Closure) and groovy.json.JsonOutput.toJson(Object) enable access to private data that would otherwise be restricted due to script security.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-1000095

GHSA-M68X-CC2F-GR5H

Affected Products

Groovy

Jenkins

References · 4

• https://jenkins.io/security/advisory/2017-07-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000095 · Security Note
• https://osv.dev/vulnerability/GHSA-m68x-cc2f-gr5h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000095 · Vendor Advisory